[mdavidn]

Reading the user's profile information _is_ the delegated action. OAuth providers were already doing this prior to OIDC but in incompatible ways. OIDC standardized how that information is requested and returned.

[tptacek]

No, the whole point of OIDC is that permission to read your profile is not semantically the same thing as authenticated sign-on.